Card-Not-Present Fraud (Attack Tree)
Getting card data, defeating step-up authentication and converting to value before chargeback, costed by attacker effort and detectability.
Make it your own.
title "Card-not-present fraud on a merchant checkout"
goal G "Make a successful fraudulent purchase"
OR G1 "Obtain card data" parent G
OR G2 "Defeat step-up authentication" parent G
AND G3 "Convert to value before chargeback" parent G
leaf L1 "Buy a card dump on a market" parent G1 cost 1 skill low detect low
leaf L2 "Skimming script on the checkout page" parent G1 cost 4 skill high detect medium
leaf L3 "Phish the cardholder for card and security code" parent G1 cost 2 skill low detect medium
leaf L4 "SIM swap to intercept the one-time passcode" parent G2 cost 3 skill medium detect medium
leaf L5 "Social engineer an in-app approval" parent G2 cost 2 skill medium detect low
leaf L6 "Exploit a frictionless authentication exemption" parent G2 cost 3 skill high detect high
leaf L7 "Order high-resale goods for click and collect" parent G3 cost 1 skill low detect medium
leaf L8 "Use a mule address and a reshipper" parent G3 cost 2 skill low detect high